David Sterba cc8c67cadc btrfs: use correct types for page indices in btrfs_page_exists_in_range ... commit cc2b702c52094b637a351d7491ac5200331d0445 upstream. Variables start_idx and end_idx are supposed to hold a page index derived from the file offsets. The int type is not the right one though, offsets larger than 1 << 44 will get silently trimmed off the high bits. (1 << 44 is 16TiB) What can go wrong, if start is below the boundary and end gets trimmed: - if there's a page after start, we'll find it (radix_tree_gang_lookup_slot) - the final check "if (page->index <= end_idx)" will unexpectedly fail The function will return false, ie. "there's no page in the range", although there is at least one. btrfs_page_exists_in_range is used to prevent races in: * in hole punching, where we make sure there are not pages in the truncated range, otherwise we'll wait for them to finish and redo truncation, but we're going to replace the pages with holes anyway so the only problem is the intermediate state * lock_extent_direct: we want to make sure there are no pages before we lock and start DIO, to prevent stale data reads For practical occurence of the bug, there are several constaints. The file must be quite large, the affected range must cross the 16TiB boundary and the internal state of the file pages and pending operations must match. Also, we must not have started any ordered data in the range, otherwise we don't even reach the buggy function check. DIO locking tries hard in several places to avoid deadlocks with buffered IO and avoids waiting for ranges. The worst consequence seems to be stale data read. CC: Liu Bo <bo.li.liu@oracle.com> Fixes: fc4adbff82 ("btrfs: Drop EXTENT_UPTODATE check in hole punching and direct locking") Reviewed-by: Liu Bo <bo.li.liu@oracle.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-06-14 13:16:24 +02:00
..
9p	9p: fix a potential acl leak	2017-05-14 13:32:54 +02:00
adfs
affs	affs: fix remount failure when there are no options changed	2016-06-07 18:14:32 -07:00
afs
autofs4	autofs: use dentry flags to block walks during expire	2016-09-30 10:18:37 +02:00
befs
bfs
btrfs	btrfs: use correct types for page indices in btrfs_page_exists_in_range	2017-06-14 13:16:24 +02:00
cachefiles	FS-Cache: Add missing initialization of ret in cachefiles_write_page()	2015-11-16 20:38:43 -05:00
ceph	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
cifs	CIFS: add misssing SFM mapping for doublequote	2017-05-20 14:27:01 +02:00
coda	fs/coda: fix readlink buffer overflow	2015-09-10 13:29:01 -07:00
configfs	configfs: allow dynamic group creation	2015-11-20 16:17:32 -08:00
cramfs
debugfs	debugfs: Make automount point inodes permanently empty	2016-05-04 14:48:41 -07:00
devpts	devpts: clean up interface to pty drivers	2016-08-16 09:30:49 +02:00
dlm	dlm: free workqueues after the connections	2016-10-22 12:26:56 +02:00
ecryptfs	ecryptfs: fix handling of directory opening	2016-09-15 08:27:47 +02:00
efivarfs	efi: Make efivarfs entries immutable by default	2016-03-03 15:07:09 -08:00
efs
exofs	osd fs: __r4w_get_page rely on PageUptodate for uptodate	2015-12-12 10:15:34 -08:00
exportfs
ext2	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
ext4	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
f2fs	fscrypt: avoid collisions when presenting long encrypted filenames	2017-05-25 14:30:11 +02:00
fat	fat: fix using uninitialized fields of fat_inode/fsinfo_inode	2017-03-15 09:57:15 +08:00
freevxfs	freevxfs: Grammar s/an negative/a negative/	2015-08-07 13:59:24 +02:00
fscache	FS-Cache: Handle a write to the page immediately beyond the EOF marker	2015-11-11 02:11:02 -05:00
fuse	fuse: add missing FR_FORCE	2017-03-12 06:37:28 +01:00
gfs2	gfs2: avoid uninitialized variable warning	2017-04-30 05:49:28 +02:00
hfs	hfs: fix B-tree corruption after insertion at position 0	2015-09-10 13:29:01 -07:00
hfsplus	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
hostfs	hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()	2016-09-30 10:18:39 +02:00
hpfs	hpfs: implement the show_options method	2016-06-01 12:15:54 -07:00
hugetlbfs	fs/hugetlbfs/inode.c: fix bugs in hugetlb_vmtruncate_list()	2016-02-25 12:01:22 -08:00
isofs	isofs: Do not return EACCES for unknown filesystems	2016-10-28 03:01:34 -04:00
jbd2	jbd2: don't leak modified metadata buffers on an aborted journal	2017-03-12 06:37:26 +01:00
jffs2	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
jfs	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
kernfs	kernfs: don't depend on d_find_any_alias() when generating notifications	2016-09-24 10:07:36 +02:00
lockd	Mainly smaller bugfixes and cleanup. We're still finding some bugs from	2015-11-11 20:11:28 -08:00
logfs	mm, fs: introduce mapping_gfp_constraint()	2015-11-06 17:50:42 -08:00
minix
ncpfs	ncpfs: fix a braino in OOM handling in ncp_fill_cache()	2016-03-16 08:42:59 -07:00
nfs	NFSv4: fix getacl ERANGE for some ACL buffer sizes	2017-03-12 06:37:30 +01:00
nfs_common	lockd: NLM grace period shouldn't block NFSv4 opens	2015-08-13 10:22:06 -04:00
nfsd	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
nilfs2	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
nls
notify	fanotify: fix list corruption in fanotify_get_response()	2016-09-30 10:18:37 +02:00
ntfs	mm, fs: introduce mapping_gfp_constraint()	2015-11-06 17:50:42 -08:00
ocfs2	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
omfs
openpromfs
overlayfs	ovl: fsync after copy-up	2016-11-10 16:36:34 +01:00
proc	proc: Fix unbalanced hard link numbers	2017-05-25 14:30:10 +02:00
pstore	pstore/ram: Use memcpy_fromio() to save old buffer	2016-10-28 03:01:27 -04:00
qnx4
qnx6
quota	quota: Fix possible GPF due to uninitialised pointers	2016-04-12 09:08:56 -07:00
ramfs	mm, fs: obey gfp_mapping for add_to_page_cache()	2015-10-16 11:42:28 -07:00
reiserfs	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
romfs
squashfs	squashfs: xattr simplifications	2015-11-13 20:34:33 -05:00
sysfs	sysfs: be careful of error returns from ops->show()	2017-04-12 12:38:33 +02:00
sysv	fix sysvfs symlinks	2015-11-23 21:11:08 -05:00
tracefs	tracefs: Fix refcount imbalance in start_creating()	2015-11-04 22:13:45 -05:00
ubifs	ubifs: Fix journal replay wrt. xattr nodes	2017-01-26 08:23:48 +01:00
udf	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
ufs	ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path	2017-06-14 13:16:24 +02:00
xfs	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
aio.c	aio: mark AIO pseudo-fs noexec	2016-10-07 15:23:47 +02:00
anon_inodes.c
attr.c	vfs: move permission checking into notify_change() for utimes(NULL)	2016-10-22 12:26:56 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c	Merge branch 'for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2015-11-11 09:45:24 -08:00
binfmt_elf_fdpic.c	libnvdimm for 4.4:	2015-11-10 12:07:22 -08:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
block_dev.c	fs/block_dev: always invalidate cleancache in invalidate_bdev()	2017-05-20 14:27:01 +02:00
buffer.c	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
char_dev.c	fs/char_dev.c: fix incorrect documentation for unregister_chrdev_region	2015-08-05 13:49:35 -07:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c	i2c-dev: Fix typo in ioctl name reference	2015-10-23 23:26:43 +02:00
coredump.c	coredump: fix unfreezable coredumping task	2016-11-18 10:48:34 +01:00
dax.c	dax: disable pmd mappings	2015-11-16 23:54:45 -08:00
dcache.c	mnt: Protect the mountpoint hashtable with mount_lock	2017-01-19 20:17:21 +01:00
dcookies.c
direct-io.c	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
drop_caches.c	inode: convert inode_sb_list_lock to per-sb	2015-08-17 18:39:46 -04:00
eventfd.c
eventpoll.c
exec.c	exec: Ensure mm->user_ns contains the execed files	2017-01-06 11:16:14 +01:00
fcntl.c
fhandle.c	fs/coredump: prevent fsuid=0 dumps into user-controlled directories	2016-04-12 09:08:58 -07:00
file.c	vfs: clear remainder of 'full_fds_bits' in dup_fd()	2015-11-05 23:05:32 -08:00
file_table.c	fs, file table: reinit files_stat.max_files after deferred memory initialisation	2015-08-07 04:39:40 +03:00
filesystems.c
fs-writeback.c	writeback, cgroup: fix use of the wrong bdi_writeback which mismatches the inode	2016-04-12 09:09:04 -07:00
fs_pin.c
fs_struct.c
inode.c	vfs: fix deadlock in file_remove_privs() on overlayfs	2016-08-10 11:49:30 +02:00
internal.h	inode: rename i_wb_list to i_io_list	2015-08-17 23:38:10 -04:00
ioctl.c
Kconfig	dax: disable pmd mappings	2015-11-16 23:54:45 -08:00
Kconfig.binfmt
libfs.c	fs: Set the size of empty dirs to 0.	2015-08-12 15:28:45 -05:00
locks.c	locks: use file_inode()	2016-08-10 11:49:27 +02:00
Makefile	ext4: promote ext4 over ext2 in the default probe order	2015-10-15 10:33:21 -04:00
mbcache.c
mount.h	mnt: Add a per mount namespace limit on the number of mounts	2017-04-30 05:49:28 +02:00
mpage.c	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
namei.c	fs: Check for invalid i_uid in may_follow_link()	2016-09-15 08:27:49 +02:00
namespace.c	mnt: Add a per mount namespace limit on the number of mounts	2017-04-30 05:49:28 +02:00
no-block.c
nsfs.c	fs/seq_file: convert int seq_vprint/seq_printf/etc... returns to void	2015-09-11 15:21:34 -07:00
open.c	vfs: add vfs_select_inode() helper	2016-05-18 17:06:48 -07:00
pipe.c	pipe: limit the per-user amount of pages allocated in pipes	2016-06-07 18:14:35 -07:00
pnode.c	mnt: Add a per mount namespace limit on the number of mounts	2017-04-30 05:49:28 +02:00
pnode.h	mnt: Add a per mount namespace limit on the number of mounts	2017-04-30 05:49:28 +02:00
posix_acl.c	tmpfs: clear S_ISGID when setting posix ACLs	2017-01-26 08:23:47 +01:00
proc_namespace.c	vfs: show_vfsstat: do not ignore errors from show_devname method	2016-04-12 09:08:55 -07:00
read_write.c
readdir.c
select.c
seq_file.c	fs/seq_file: fix out-of-bounds read	2016-09-07 08:32:43 +02:00
signalfd.c	signalfd: fix information leak in signalfd_copyinfo	2015-08-07 04:39:40 +03:00
splice.c	vfs: fix uninitialized flags in splice_to_pipe()	2017-02-23 17:43:09 +01:00
stack.c
stat.c	ufs: restore maintaining ->i_blocks	2017-06-14 13:16:24 +02:00
statfs.c
super.c	fs/super.c: fix race between freeze_super() and thaw_super()	2016-10-28 03:01:32 -04:00
sync.c	fs/sync.c: make sync_file_range(2) use WB_SYNC_NONE writeback	2015-11-06 17:50:42 -08:00
timerfd.c	timerfd: Protect the might cancel mechanism proper	2017-05-08 07:46:01 +02:00
userfaultfd.c	userfaultfd: don't block on the last VM updates at exit time	2016-03-16 08:43:01 -07:00
utimes.c	vfs: move permission checking into notify_change() for utimes(NULL)	2016-10-22 12:26:56 +02:00
xattr.c	fs/xattr.c: zero out memory copied to userspace in getxattr	2017-05-20 14:27:01 +02:00